[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fViWxo4juC82uT-wvxHvooxljP35ttaeEzUc-NzI6noE":3},{"article":4,"iocs":48,"watch_terms":61,"solutions":62,"lesson":157},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"8e005edd-3336-491c-908d-2dce6b0a2deb","Critical PHP2Shell Exploit Code Goes Public as Hackers Attempt to Deploy Botnet Malware","critical-php2shell-exploit-code-goes-public-as-hackers-attempt-to-deploy-botnet-c6e1f0","Public proof-of-concept code for two critical PHP vulnerabilities is now available, and attackers have tried to use the flaws to deploy botnet malware. Known together as PHP2Shell, CVE-2026-109618 and CVE-2026-109619 both carry a CVSS severity score of 9.2 and can allow attackers to run code without logging in. However, attempted exploitation must not be confused […] The post Critical PHP2Shell Exploit Code Goes Public as Hackers Attempt to Deploy Botnet Malware appeared first on Cyber Security News.","Public proof-of-concept code for two critical PHP vulnerabilities, collectively known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), has been released. Attackers have attempted to leverage these flaws, which allow unauthenticated code execution, to deploy botnet malware, specifically a Mirai variant named Potassium. While Sophos observed scanning and failed exploit attempts, they found no evidence of successful compromise.","Public exploit code for critical PHP vulnerabilities PHP2Shell (CVE-2026-109618, CVE-2026-109619) released; attackers","https:\u002F\u002Fcybersecuritynews.com\u002Fcritical-php2shell-exploit-code\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FCritical-PHP2Shell-Exploit-Code-Goes-Public-as-Hackers-Attempt-to-Deploy-Botnet-Malware.webp","2026-10-23T13:00:37+00:00","2026-10-23T15:08:57.299209+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"PHP","product",{"name":21,"type":19},"PHP-FPM",{"name":23,"type":19},"mod_php",{"name":25,"type":19},"php-cgi",{"name":27,"type":19},"FrankenPHP",{"name":29,"type":19},"LiteSpeed","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,38,43],{"category":37},{"id":30,"icon":32,"name":33,"slug":34},{"category":39},{"id":40,"icon":32,"name":41,"slug":42},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49,53,55,58],{"type":50,"value":51,"context":52},"cve","CVE-2026-109618","PHP2Shell vulnerability allowing unauthenticated code execution.",{"type":50,"value":54,"context":52},"CVE-2026-109619",{"type":42,"value":56,"context":57},"Potassium","Mirai botnet variant payload attempted by attackers.",{"type":42,"value":59,"context":60},"Mirai","Botnet variant family of the Potassium payload.",[18,21,23],{"controls":63,"vendors":150},[64,93,122],{"slug":65,"name":66,"problem":67,"products":68},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":94,"name":95,"problem":96,"products":97},"patch-management","Automated patch management","Known holes get closed in days, not months.",[98,106,114],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":47,"name":123,"problem":124,"products":125},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[126,134,142],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",[151],{"slug":152,"name":153,"logo_path":154,"roles":155},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png",[156],"reported_by",{"slug":158,"title":159,"body":160,"framework_refs":161,"framework_notes":169},"public-php2shell-exploit-drives-botnet-deployment-attempts","Public PHP2Shell Exploit Drives Botnet Deployment Attempts","Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), allowing unauthenticated remote code execution, were quickly weaponized after proof-of-concept exploit code was made publicly available. Attackers wasted no time attempting to deploy a Mirai-variant botnet (Potassium) against unpatched internet-facing PHP systems. The window between public PoC release and active exploitation attempts was extremely short, highlighting that once exploit code is public, organizations have little time to react. While no successful compromises were confirmed in this instance, the incident underscores the critical importance of proactive patch management and continuous vulnerability monitoring for externally exposed services.",[162,163,164,165,166,167,168],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":170,"PCI DSS Requirement 6":171,"NIST SP 800-53 SI-2: Flaw Remediation":172,"CIS Control 17: Incident Response Management":173,"OWASP A06:2021 Vulnerable and Outdated Components":174,"CIS Control 7: Continuous Vulnerability Management":175,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":176},"NIS2 mandates incident handling and vulnerability management practices for essential entities; the rapid weaponization of these PHP flaws illustrates why NIS2-compliant organizations must have processes to act on critical disclosures immediately.","Requirement 6 mandates that organizations develop and maintain secure systems by applying security patches in a timely manner, which would have closed the PHP2Shell attack surface before botnet deployment was attempted.","SI-2 requires organizations to identify, report, and correct information system flaws promptly; adherence to this control would mandate emergency patching of the critical PHP RCE vulnerabilities within a defined timeframe.","Having a tested incident response plan that includes procedures for critical vulnerability disclosures and active exploitation attempts would have enabled faster, more coordinated defensive actions when scanning activity was first detected.","PHP2Shell exploits precisely the risk described in A06 — using components with known, unpatched vulnerabilities — making component version management and rapid patching essential countermeasures.","Regular, automated vulnerability scanning and a defined remediation timeline would have identified the unpatched PHP flaws before public PoC code accelerated attacker exploitation attempts.","This control requires timely identification and remediation of technical vulnerabilities in used software, directly addressing the failure to patch internet-facing PHP systems before exploit code was published."]